# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=48 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 49 --- ## [Filebeat+pipeline+es log duplication Help!](https://discuss.elastic.co/t/filebeat-pipeline-es-log-duplication-help/334406)
**Author:** [@Teresajw](https://discuss.elastic.co/u/Teresajw)\ **Replies:** 1\ **Last updated:** [May 26, 2023, 12:23pm UTC](https://discuss.elastic.co/t/filebeat-pipeline-es-log-duplication-help/334406 "2023-05-26T12:23:27Z")
When I use the following configuration of filebeat+pipeline to collect nginx logs, multiple duplicate logs will be generated in Elasticsearch, but I cannot find the reason, despite testing many times. Could you please he… --- ## [Fortinet traffic logs: how to create a dashboard that shows generated traffic per host?](https://discuss.elastic.co/t/fortinet-traffic-logs-how-to-create-a-dashboard-that-shows-generated-traffic-per-host/334421)
**Author:** [@CyberPingU](https://discuss.elastic.co/u/CyberPingU)\ **Replies:** 0\ **Last updated:** [May 26, 2023, 10:35am UTC](https://discuss.elastic.co/t/fortinet-traffic-logs-how-to-create-a-dashboard-that-shows-generated-traffic-per-host/334421 "2023-05-26T10:35:01Z")
Hello, I'm using filebeat with elastic and kibana to manage my fortinet (7.2.4) logs. I cannot understand how to create a dashboard that is showing me how much traffic a host is doing. I thought that I could use desti… --- ## [High iops from filebeat](https://discuss.elastic.co/t/high-iops-from-filebeat/334399)
**Author:** [@dimovvasiliy](https://discuss.elastic.co/u/dimovvasiliy)\ **Replies:** 0\ **Last updated:** [May 26, 2023, 6:37am UTC](https://discuss.elastic.co/t/high-iops-from-filebeat/334399 "2023-05-26T06:37:55Z")
Hi there! I faced with a filebeat high io consumption problem. Sometimes some of my filebeat daemons start to make abnormal number of io requests (thousands per seond). I checked it and found that filebeat make a checkp… --- ## [Tail\_files option for filebeat not working as expected](https://discuss.elastic.co/t/tail-files-option-for-filebeat-not-working-as-expected/334359)
**Author:** [@Puneet\_Singh](https://discuss.elastic.co/u/Puneet_Singh)\ **Replies:** 1\ **Last updated:** [May 25, 2023, 6:53pm UTC](https://discuss.elastic.co/t/tail-files-option-for-filebeat-not-working-as-expected/334359 "2023-05-25T18:53:50Z")
I have downloaded filebeat 8.8.0 today and it seems that the tail\_files option is not working as expected. When i run filebeat, the filebeat seems to be scanning entire file and scanning everything, instead of shipping … --- ## [Filter with winlogbeat](https://discuss.elastic.co/t/filter-with-winlogbeat/324621)
**Author:** [@BeyondRAM](https://discuss.elastic.co/u/BeyondRAM)\ **Replies:** 13\ **Last updated:** [May 25, 2023, 5:10pm UTC](https://discuss.elastic.co/t/filter-with-winlogbeat/324621 "2023-05-25T17:10:40Z")
Hello I got winlogbeat on my file server which brings up specifics ressources from an file audit, 4663, 4670 and 4659 events, well file activy actually. I got an issue, I want to create a dashboard with the files the mo… --- ## [Filebeat Error and Configuration Issues](https://discuss.elastic.co/t/filebeat-error-and-configuration-issues/334094)
**Author:** [@Priyaansh\_Dwivedi](https://discuss.elastic.co/u/Priyaansh_Dwivedi)\ **Replies:** 3\ **Last updated:** [May 25, 2023, 11:56am UTC](https://discuss.elastic.co/t/filebeat-error-and-configuration-issues/334094 "2023-05-25T11:56:20Z")
Despite my efforts, I have been unable to resolve the following error messages and configuration challenges. Your expertise and guidance would be greatly appreciated! When checking the status of Filebeat, I encountered … --- ## [Time zone abbr is ambigous which cause @timestamp parsed wrong \[for Postgresql module\]](https://discuss.elastic.co/t/time-zone-abbr-is-ambigous-which-cause-timestamp-parsed-wrong-for-postgresql-module/333863)
**Author:** [@yanhj93](https://discuss.elastic.co/u/yanhj93)\ **Replies:** 1\ **Last updated:** [May 24, 2023, 2:33pm UTC](https://discuss.elastic.co/t/time-zone-abbr-is-ambigous-which-cause-timestamp-parsed-wrong-for-postgresql-module/333863 "2023-05-24T14:33:13Z")
Our postgre server log with timezone CST, in this case it represents China standard time. pipeline(module provid) will parse the log message and read timezone value use WORD pattern, finally date processor parse the tim… --- ## [Filebeat not sending logs to elasticsearch](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-elasticsearch/334106)
**Author:** [@mohammad\_messiah](https://discuss.elastic.co/u/mohammad_messiah)\ **Replies:** 1\ **Last updated:** [May 24, 2023, 1:47pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-elasticsearch/334106 "2023-05-24T13:47:04Z")
Filebeat not sending logs to elasticsearch. Tried restart of elasticstack, reinstall of filebeat agent on few nodes, renaming the registry files to force index rebuild, removing lock file under /var/lib/filebeat but noth… --- ## [Unable to create index with %{type} in logstash output](https://discuss.elastic.co/t/unable-to-create-index-with-type-in-logstash-output/334079)
**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Replies:** 2\ **Last updated:** [May 24, 2023, 1:18pm UTC](https://discuss.elastic.co/t/unable-to-create-index-with-type-in-logstash-output/334079 "2023-05-24T13:18:10Z")
Hi here is my logstash config file input { beats { port =\> 5044 } } output { elasticsearch { hosts =\> "http://IP:9200" index =\> "%{type}%{+YYYY.MM.dd}" user =\> "elastic" password =\> "pwd" } … --- ## [Logs monitoring through Filebeat](https://discuss.elastic.co/t/logs-monitoring-through-filebeat/333753)
**Author:** [@Kumar\_Arsh](https://discuss.elastic.co/u/Kumar_Arsh)\ **Replies:** 7\ **Last updated:** [May 23, 2023, 10:04am UTC](https://discuss.elastic.co/t/logs-monitoring-through-filebeat/333753 "2023-05-23T10:04:04Z")
How can I use filebeat to read logs from another server? What will be the configuration that will be required? --- ## [Kubernetes custom pipeline processing](https://discuss.elastic.co/t/kubernetes-custom-pipeline-processing/333946)
**Author:** [@Vijayakumar\_Kannan](https://discuss.elastic.co/u/Vijayakumar_Kannan)\ **Replies:** 4\ **Last updated:** [May 22, 2023, 5:44pm UTC](https://discuss.elastic.co/t/kubernetes-custom-pipeline-processing/333946 "2023-05-22T17:44:50Z")
In pod following annotations mentioned but pipeline is not processing. annotations: co.elastic.logs/enabled: 'true' co.elastic.logs/fileset: syslog co.elastic.logs/module: system co… --- ## [Unable to start Auditbeat on Proxmox Container](https://discuss.elastic.co/t/unable-to-start-auditbeat-on-proxmox-container/333886)
**Author:** [@tli](https://discuss.elastic.co/u/tli)\ **Replies:** 1\ **Last updated:** [May 22, 2023, 4:36pm UTC](https://discuss.elastic.co/t/unable-to-start-auditbeat-on-proxmox-container/333886 "2023-05-22T16:36:15Z")
Hi, I tried to install auditbeat on Proxmox Container (Ubuntu) It failed with following msg written to the log 2023-05-19T15:03:04.117-0400 INFO instance/beat.go:309 Setup Beat: auditbeat; Version: 7.15.0 20… --- ## [Filebeat module specific output : why is this a global config?](https://discuss.elastic.co/t/filebeat-module-specific-output-why-is-this-a-global-config/333741)
**Author:** [@sriramb12](https://discuss.elastic.co/u/sriramb12)\ **Replies:** 5\ **Last updated:** [May 22, 2023, 5:10am UTC](https://discuss.elastic.co/t/filebeat-module-specific-output-why-is-this-a-global-config/333741 "2023-05-22T05:10:44Z")
I have multiple modules active and like to have each module output saved to a distinct location as I choose file ouput (no elastic integration) I see the output configuration as part of filebeat.yml, which is a global c… --- ## [Which beat runs? How do i know it?](https://discuss.elastic.co/t/which-beat-runs-how-do-i-know-it/333286)
**Author:** [@zeynepyz](https://discuss.elastic.co/u/zeynepyz)\ **Replies:** 2\ **Last updated:** [May 20, 2023, 8:06am UTC](https://discuss.elastic.co/t/which-beat-runs-how-do-i-know-it/333286 "2023-05-20T08:06:46Z")
I was trying to make a new beat that collects k6 metrics via rest api and then send them into Elasticsearch. I follow the 7.17 Dev Guide " Creating a Beat based on Metricbeat" documentation. But it's like my beat doesn't… --- ## [Which process comes first in Filebeat v.8？](https://discuss.elastic.co/t/which-process-comes-first-in-filebeat-v-8/333822)
**Author:** [@m-amano](https://discuss.elastic.co/u/m-amano)\ **Replies:** 1\ **Last updated:** [May 19, 2023, 9:13am UTC](https://discuss.elastic.co/t/which-process-comes-first-in-filebeat-v-8/333822 "2023-05-19T09:13:30Z")
Hello. I'm using Filebeat v.8.6.2 to send data to Logstash with filestream input type and I'm curious about which process comes first. Harvest input file data(end of file reached) Connecting Filebeat to Logstash --- ## [elasticsearch/client.go:408 Cannot index event publisher.Event](https://discuss.elastic.co/t/elasticsearch-client-go-408-cannot-index-event-publisher-event/333809)
**Author:** [@reddyk001](https://discuss.elastic.co/u/reddyk001)\ **Replies:** 0\ **Last updated:** [May 18, 2023, 8:50pm UTC](https://discuss.elastic.co/t/elasticsearch-client-go-408-cannot-index-event-publisher-event/333809 "2023-05-18T20:50:17Z")
Hello All, i was trying to send k8s container logs to Elasticsearch through filebeat. we are getting more logs that expected and also it is trigger the below warning continuously from filebeat side and it trying write … --- ## [Filebeat kubernetes autodiscovery per namespace & kibana missing beats](https://discuss.elastic.co/t/filebeat-kubernetes-autodiscovery-per-namespace-kibana-missing-beats/333722)
**Author:** [@bdols](https://discuss.elastic.co/u/bdols)\ **Replies:** 1\ **Last updated:** [May 18, 2023, 6:26am UTC](https://discuss.elastic.co/t/filebeat-kubernetes-autodiscovery-per-namespace-kibana-missing-beats/333722 "2023-05-18T06:26:44Z")
I've used this as a starting point to get ECK up and running: github/elastic/cloud-on-k8s/2.7/config/recipes/beats/stack\_monitoring.yaml I just want metrics and logs collected for elastic in one namespace, and the file… --- ## [Linux client data not visible on ELK server after](https://discuss.elastic.co/t/linux-client-data-not-visible-on-elk-server-after/333521)
**Author:** [@jg23](https://discuss.elastic.co/u/jg23)\ **Replies:** 4\ **Last updated:** [May 18, 2023, 6:07am UTC](https://discuss.elastic.co/t/linux-client-data-not-visible-on-elk-server-after/333521 "2023-05-18T06:07:13Z")
Hi, I recently installed the ELK stack on a Linux server running Ubuntu 22.04 using the following as a guide: After the initial installation and setup, I've also been able to successfully send logs from 4 other linux … --- ## [Filebeat on ELK not sending from configured paths](https://discuss.elastic.co/t/filebeat-on-elk-not-sending-from-configured-paths/333706)
**Author:** [@roman-tasi](https://discuss.elastic.co/u/roman-tasi)\ **Replies:** 0\ **Last updated:** [May 18, 2023, 2:34am UTC](https://discuss.elastic.co/t/filebeat-on-elk-not-sending-from-configured-paths/333706 "2023-05-18T02:34:59Z")
In my /etc/filebeat/filebeat.yml I have this set: paths: - /var/log/audit/audit.log - /var/log/secure But in our Kibana we only seem to be receiving from this log.file.path : /var/log/messages Not sure why --- ## [Normalizing Fields](https://discuss.elastic.co/t/normalizing-fields/333544)
**Author:** [@Felkio](https://discuss.elastic.co/u/Felkio)\ **Replies:** 1\ **Last updated:** [May 18, 2023, 12:02am UTC](https://discuss.elastic.co/t/normalizing-fields/333544 "2023-05-18T00:02:30Z")
Hello, we are currently using wazuh in conjunction with ELK stack 7.17.9, we would like to gradually switch to the full elastic stack, but to do this we would first like to normalize the fields that wazuh sends to elast… --- ## [Looking for help enabling Metricbeat](https://discuss.elastic.co/t/looking-for-help-enabling-metricbeat/333570)
**Author:** [@alongaks](https://discuss.elastic.co/u/alongaks)\ **Replies:** 5\ **Last updated:** [May 17, 2023, 8:45pm UTC](https://discuss.elastic.co/t/looking-for-help-enabling-metricbeat/333570 "2023-05-17T20:45:19Z")
Hello, I have a single node deploy of Elasticsearch Enterprise Search and Kibana all on version 8.6.2. In this node I enabled self-monitoring with xpack, but am trying to switch to using Metricbeat. While in 'Stack mon… --- ## [Grok error in official Azure integration](https://discuss.elastic.co/t/grok-error-in-official-azure-integration/333585)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 3\ **Last updated:** [May 17, 2023, 6:22pm UTC](https://discuss.elastic.co/t/grok-error-in-official-azure-integration/333585 "2023-05-17T18:22:24Z")
Hey, the Azure integration currently (I'm using 8.7.0) fails to ingest some Azure Activity Logs with IPv6 source addresses. The reason is this processor: - grok: field: azure.activitylogs.callerIpAddress patter… --- ## [Winlogbeat yml file missing Elasticsearch output SSl Key](https://discuss.elastic.co/t/winlogbeat-yml-file-missing-elasticsearch-output-ssl-key/333679)
**Author:** [@geomandry](https://discuss.elastic.co/u/geomandry)\ **Replies:** 0\ **Last updated:** [May 17, 2023, 4:11pm UTC](https://discuss.elastic.co/t/winlogbeat-yml-file-missing-elasticsearch-output-ssl-key/333679 "2023-05-17T16:11:28Z")
Configured my stack to SSL and lost log forwarding from Winlogbeat. Everything looks well on yml file with the exception of the Elasticsearch output key path. I did not receive a key when Elasticsearch SSL was configured… --- ## [DEPRECATED: Treating the CommonName field on X.509 certificates as a host name when no Subject Alternative Names are present is going to be removed](https://discuss.elastic.co/t/deprecated-treating-the-commonname-field-on-x-509-certificates-as-a-host-name-when-no-subject-alternative-names-are-present-is-going-to-be-removed/333326)
**Author:** [@silentfilm](https://discuss.elastic.co/u/silentfilm)\ **Replies:** 2\ **Last updated:** [May 17, 2023, 3:28pm UTC](https://discuss.elastic.co/t/deprecated-treating-the-commonname-field-on-x-509-certificates-as-a-host-name-when-no-subject-alternative-names-are-present-is-going-to-be-removed/333326 "2023-05-17T15:28:30Z")
I am getting the following deprecation warning in both filebeat and metricbeat. I am currently using ES 7.17.9, but will be upgrading to 8.x soon: DEPRECATED: Treating the CommonName field on X.509 certificates as a ho… --- ## [Fortigate Issues](https://discuss.elastic.co/t/fortigate-issues/333653)
**Author:** [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)\ **Replies:** 0\ **Last updated:** [May 17, 2023, 11:20am UTC](https://discuss.elastic.co/t/fortigate-issues/333653 "2023-05-17T11:20:12Z")
I have deployed the Fortigate integration using Fleet to one of my Elastic Agents. When I run tcpdump, I see a lot of UDP traffic on the host running the agent. However; I don't see any of that data in Elastic. I'm ev… --- ## [Auditbeat - User Attribution](https://discuss.elastic.co/t/auditbeat-user-attribution/333620)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 0\ **Last updated:** [May 17, 2023, 3:53am UTC](https://discuss.elastic.co/t/auditbeat-user-attribution/333620 "2023-05-17T03:53:01Z")
Hi, We are running auditbeat with the auditd module using standard auditd.rules. We are seeing the events in our Elasticsearch instance, however there is no user attribution tied to the events. It's great that we are … --- ## [Winlogbeat mapping to OCSF](https://discuss.elastic.co/t/winlogbeat-mapping-to-ocsf/333605)
**Author:** [@Zachary\_Schmerber](https://discuss.elastic.co/u/Zachary_Schmerber)\ **Replies:** 0\ **Last updated:** [May 16, 2023, 9:03pm UTC](https://discuss.elastic.co/t/winlogbeat-mapping-to-ocsf/333605 "2023-05-16T21:03:40Z")
Hello, I am trying to find a way to remove the ECS mappings that defaults in winlogbeats and move to OCSF mapping. Anyone know where the logic for the ECS transformations lives or have a repo for winlogbeat that dose not… --- ## [How to create the Multiple Index for each Apache Webserver](https://discuss.elastic.co/t/how-to-create-the-multiple-index-for-each-apache-webserver/333492)
**Author:** [@sanjeev1895](https://discuss.elastic.co/u/sanjeev1895)\ **Replies:** 1\ **Last updated:** [May 16, 2023, 8:21pm UTC](https://discuss.elastic.co/t/how-to-create-the-multiple-index-for-each-apache-webserver/333492 "2023-05-16T20:21:01Z")
Hi, I'm a new to ELK stack. Can anyone advice me for my below doubt. For example, I have a two apache webserver and I installed filebeat on that and I enabled apache module. Also I configured apache.conf file in logsta… --- ## [Error in Multiline parser of timestamp](https://discuss.elastic.co/t/error-in-multiline-parser-of-timestamp/333598)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 0\ **Last updated:** [May 16, 2023, 7:39pm UTC](https://discuss.elastic.co/t/error-in-multiline-parser-of-timestamp/333598 "2023-05-16T19:39:48Z")
Having an issue with a multiline parser in one of own filebeat instance type of Redhat AMQ log which puzzles me, so any hints are appreciated, TIA. See all events dropped in filebeat log due to error like this: {\\"type… --- ## [Potential logs loss on a WEC server via Winlogbeat](https://discuss.elastic.co/t/potential-logs-loss-on-a-wec-server-via-winlogbeat/331561)
**Author:** [@rpe](https://discuss.elastic.co/u/rpe)\ **Replies:** 1\ **Last updated:** [May 16, 2023, 2:58pm UTC](https://discuss.elastic.co/t/potential-logs-loss-on-a-wec-server-via-winlogbeat/331561 "2023-05-16T14:58:53Z")
Hello, I deployed a WEC with a customer to forward its Windows logs to our SIEM, following the Elastic WEC Server cookbook. However, after synchronizing with the customer, he generated some events that we didn't receiv… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=47) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=49)